Splunk Search

Field extraction based on position of character

mbasharat
Builder

Hi,

I have field that gives me NETBOS of a Host.

Sample Host Name: 123456W12345678

The 7th character makes the identification for whether it is server or not a server.

How to extract this 7th character into a new field "Classification"? Result using above example should be:
field name=Classification
field value=W

Thanks in advance!!!

Tags (1)
0 Karma
1 Solution

mayurr98
Super Champion

try this :

| makeresults | eval host="123456412345678" | rex field=host "(\d{6}|\w{6})?(?<Classification>\w{1})"

View solution in original post

0 Karma

mayurr98
Super Champion

try this :

| makeresults | eval host="123456412345678" | rex field=host "(\d{6}|\w{6})?(?<Classification>\w{1})"
0 Karma

mbasharat
Builder

Worked. THANKS!!!

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...